ENVIRONMENTAL, HEALTH & SAFETY KNOWLEDGE BRIEF

EHS PLANNING FOR COVID-19 AND BEYOND Internal audit’s role in crisis preparation and response

By Roy A. Litzenberg, CPEA  

Table of Contents

Introduction ................................................................................................................................................... 1

A risk worth heeding ............................................................................................................................ 1

Crisis preparedness ..................................................................................................................................... 2

Preparation is key ................................................................................................................................ 2

Pre-define roles .................................................................................................................................... 2

Plan for impact on employees and customers .................................................................................. 3

Establish policies in advance ...................................................................................................................... 4

Policy areas to consider ...................................................................................................................... 4

Protect employees and customers ..................................................................................................... 4

Educate employees .............................................................................................................................. 5

Coordinate with external organizations and help your community ................................................. 5

Risks to the global economy ....................................................................................................................... 6

Adhering to the Standards .................................................................................................................. 6

About the Author

Roy A. Litzenberg, CPEA

Roy Litzenberg has over 30 years of experience in environmental, health and safety compliance,

including EHS, security and transportation audits, regulatory compliance, and environmental due

diligence. As a CPEA, Litzenberg has served as an EHS auditor on more than 300 facility audits.

He also is an experienced environmental professional and has completed more than 1,400

environmental due diligence assessments. Litzenberg has worked at commercial, industrial,

institutional, residential, and federal, state, and municipal government project sites throughout

California and the United States. International experience includes EHS audits at facilities in

Argentina, Brazil, Canada, Colombia, Costa Rica, the Dominican Republic, El Salvador, Honduras,

and Mexico (including work in: Aguascalientes, Atlacomulco, Cordoba, Mexicali, Navajoa,

Monterrey, Reynoso, San Luis Potosi, Saltillo, and Tijuana).

About the Expert

Douglas Hileman, CRMA, CPEA, FSA, P.E.

Douglas Hileman has 40 years of experience in compliance, operations, auditing, and nonfinancial

reporting and supports clients nationwide. He is currently leading environmental management and

auditing efforts in a partnership involving a global company. Hileman has experienced multiple lines

of defense through work with operations and corporate compliance, EHS auditing, internal audit,

and external assurance (supporting financial audits and conducting conflict minerals independent

private sector audits), and has been involved in professional organizations dedicated to EHS

auditing since the 1980s. He has been active in The IIA for over a decade, serving as a presenter,

coauthor, and contributor for practice advisories, guidance, podcasts, and webinars. In 2019,

Hileman served as co-chair of programming for The IIA’s International Conference, co-presenting

a workshop on ethics, and was also appointed as a member of the Environmental, Health & Safety

Audit Center’s advisory board.

Note: Douglas Hileman provided subject matter expertise during the development of this report.

1

INTRODUCTION

A risk worth heeding

At this point, it is hard to imagine that anyone in the developed world has not heard of the novel coronavirus

(COVID-19), as newspapers and news broadcasts provide daily updates and analysis of its rapid spread.

While COVID-19’s ultimate effects still remain to be seen, it has quickly surpassed other coronavirus outbreaks

(SARS 2002, MERS 2012) in the number of cases worldwide, topping 150,000 in mid-March.1 The World

Health Organization (WHO) continues to issue situation reports tracking the progress of this disease, while

nations around the world implement travel bans and other strict measures to contain it.

COVID-19 is dramatically impacting world stock markets, supply chains, and business and personal travel. It

even has the potential to limit availability of prescription medications. On March 11, 2020, the World Health

organization officially declared the novel coronavirus a pandemic.2

The goal of this knowledge brief is to provide practical direction to prepare organizations to weather COVID-19,

and hopefully any future potential pandemic. It draws from guidance issued by the U.S. Department of Health

and Human Services, the Centers for Disease Control and Prevention (CDC), and concludes with thoughts

on the importance of realizing that environmental, social and governance (ESG) risks — novel and well known

— are material to businesses and should be part of prudent business and audit planning.

1. Situation Report — 55, World Health Organization, March 15, 2020, https://www.who.int/docs/default-

source/coronaviruse/situation-reports/20200315-sitrep-55-covid-19.pdf?sfvrsn=33daa5cb_6.

2. Jamie Gumbrecht and Jacqueline Howard, “Now a Pandemic, Coronavirus Changes Life Indefinitely,” CNN Health,

March 11, 2020, https://www.cnn.com/2020/03/11/health/coronavirus-pandemic-world-health-organization/index.html.

2

CRISIS PREPAREDNESS

Preparation is key

As the threat of COVID-19 evolves by the day, people and organizations are evaluating what it means to

them. At the extreme ends of the spectrum are those who see it as just another news story and those who

proclaim it as the end of the global marketplace as we know it. Whatever the perspective, the worst time to

plan for a crisis is in the middle of it.

The prudent approach is to have a plan and implement it now. Now that the COVID-19 outbreak has been

officially labeled a pandemic, no organization can afford to ignore its potential short- and long-term impacts.

Those that have well-reasoned and tested plans will be in the position to survive and recover.

Pre-define roles

Organizations cannot prevent a pandemic. However, they can plan for its impact. This starts with

designating a person or group with defined roles and responsibilities for preparedness and response

planning. Pre-defining these roles and responsibilities will minimize duplicated and wasted effort or “churn”

and allow an organization to respond more nimbly, which allows the bulk of the workforce to focus on

continuing the core business. It is vital to identify essential employees and critical inputs (raw materials,

suppliers, subcontractor services/products, and logistics) that are required to maintain operations by

location and function during a pandemic.

Organizations should plan for scenarios likely to result in an increase or decrease in demand for products

and/or services during a pandemic. For example, manufacturers of testing kits, medical masks, hand

sanitizers, or other products in demand during a pandemic should develop plans to rapidly scale up production.

Here are some essential steps in developing or modifying a crisis management plan for COVID-19:

Determine the potential impact on organizational finances and work-related domestic and

international travel.

Find up-to-date, reliable pandemic information from community public health, emergency

management, and other organizations. Create sustainable links to these resources so they are ready

to access.

Establish emergency communications protocols

o Back up key contacts,

o Create a chain of communication (including suppliers and customers),

3

o Develop processes for tracking and communicating the status of facilities and employees,

o Test these systems to assure they are ready when needed.

Implement an exercise/drill program to test and, as necessary, revise the plan. This can be part of

an overall emergency preparedness program, using the 2016 National Preparedness for Response

Exercise Program (PREP) Guidelines as a guide.3

Plan for impact on employees and customers

Planning for COVID-19 must contemplate the effects on employees and customers. The following are

considerations for any organization:

Forecast and allow for employee absences due to factors such as personal illness, family member

illness, community containment measures and quarantines, school and/or business closures, and

public transportation closures.

Implement guidelines to modify the frequency and type of face-to-face contact among employees

and between employees and customers.

Encourage and track annual influenza vaccinations for employees and evaluate access to and

availability of healthcare.

Identify employees and key customers with special needs and incorporate their requirements into the

preparedness plan.

3. 2016 National Preparedness for Response Exercise Program (PREP) Guidelines, Department of Homeland Security,

U.S. Coast Guard, Environmental Protection Agency, Department of Transportation Pipeline and Hazardous Materials

Safety Administration, Department of Interior, Bureau of Safety and Environmental Enforcement, 2016,

https://www.bsee.gov/sites/bsee.gov/files/federal-register-notice/presentations/final-2016-prep-guidelines.pdf.

4

ESTABLISH POLICIES IN ADVANCE

Policy areas to consider

The worst time to develop policies is during a crisis. Take the time to establish reasoned policies that are

not created in the heat of crisis.

Policies should be considered for the following areas:

Employee compensation and sick leave. Considerations for potentially prolonged absences

unique to a pandemic (e.g., non-punitive, liberal leave) should include clear direction on when a

previously ill person is no longer infectious and can return to work.

Face-to-face employee interaction. Consider flexible worksite (e.g., telecommuting) and flexible

work hours (e.g., staggered shifts).

Suspected or confirmed exposure. Consider infection control protocols for employees who may

have been exposed, are suspected to be ill, or become ill at the worksite (e.g., immediate mandatory

sick leave, disinfecting work areas, establishing and monitoring potential exposure of co-workers).

Work-related travel and postings. Consider travel restrictions to affected geographic areas

(domestic and international). Consider how and when to evacuate employees in or near an affected

area when an outbreak begins, and develop clear guidelines for those returning from affected areas.

Implementing emergency protocols. Set up authorities, triggers and procedures for activating and

terminating the company’s response plan, altering business operations (e.g., shutting down

operations in affected areas), and transferring business knowledge to key employees.

Protect employees and customers

Act now to assure resources are available to handle differences in demand during a pandemic. Take steps to

assure that you can provide sufficient and accessible infection control supplies (e.g., hand-hygiene products,

tissues and receptacles for their disposal) at all business locations. Supplies needed during a pandemic will

be stretched, so identify alternate suppliers.

5

Educate employees

Communication is always critical, and even more when facing a crisis. Anticipate employee fear and anxiety,

rumors and misinformation, and plan your communication accordingly. Employees and customers need

information to counteract panic and protect themselves, their families, and the company.

Develop and disseminate programs and materials covering pandemic fundamentals (e.g., signs and

symptoms of influenza, modes of transmission), personal and family protection, and response

strategies (e.g., hand hygiene, coughing/sneezing etiquette, contingency plans).

Ensure that communications are culturally and linguistically appropriate.

Share x pandemic preparedness and response plans.

Provide information to support at-home care of ill employees and family members.

It is essential to develop platforms (e.g., hotlines, dedicated websites) for communicating pandemic status

and actions to employees, vendors, suppliers, and customers inside and outside the worksite in a consistent

and timely way, including redundancies in the emergency contact system. Consider having these resources

ready in a “dark” state prior to needing them, so that they can simply be activated during a pandemic.

Coordinate with external organizations and help your community

Finally, it is important to realize that organizations do not operate in a vacuum. Make plans to leverage and

support the community.

Collaborate with major healthcare facilities and federal, state, and local public health agencies and/or

emergency responders.

Understand the capabilities and plans of federal, state, and local public health agencies and

emergency responders.

Share the organization’s crisis management plans.

Share best practices with other organizations, chambers of commerce, and associates to improve

community response efforts.

While a single organization cannot prevent a pandemic, many resources are available to plan for and manage

its effects should they happen. The following resources provide additional information and assistance as

organizations prepare:

Resources Related to Pandemics

SOURCE PUBLICATION

OSHA How to Protect Yourself in the Workplace During a Pandemic

OSHA Guidance on Preparing for an Influenza Pandemic

CDC Pandemic Influenza

6

RISKS TO THE GLOBAL ECONOMY

Adhering to the Standards

After organizations prepare to manage a crisis, there is

time to take a step back and think about risk. How can an

organization plan for the unknown and unknowable future,

minimize the downside of risk, and even make the most of

the opportunity?

When it comes to pandemic flus, global risk is nothing new.

According to the CDC, the pandemic flu H1N1 (commonly

known as the Spanish Flu) spread worldwide between

1918 and 1919. It is estimated that 500 million people or

one-third of the world’s population at the time became

infected with this virus. The number of deaths was

estimated to be at least 50 million worldwide.

Is COVID-19 different? Recency bias, the tendency to

weigh recent events more heavily than earlier events, may

be feeding the intense reaction by global markets and

panicked rush on medical and other supplies. Beyond such bias, however, is the emergence of COVID-19 at

a time when the level of globalization is unprecedented in human history.

Globalized supply chains allow many consumers to reap the benefits of cheap goods sourced throughout

the world. Global supply chains allow companies to benefit from lower costs, greater variety, higher volume,

and international customers, among other things. However, global supply chains expose companies to

risks, as well.

Recency bias and the impact of COVID-19 should challenge our understanding and consideration of risks,

and specifically Environmental, Social and Governance (ESG) risk when it comes to business and global

supply chain risk planning and management.

From an internal audit perspective, The IIA’s International Standards for the Professional Practice of Internal

Auditing (Standards), on Due Professional Care (1220.A3) states, “Internal auditors must be alert to the

significant risks that might affect objectives, operations, or resources.”

Audit Focus

Standard 1220.A3 — Due Professional

Care

Internal Auditors must be alert to the

significant risks that might affect

objectives, operations, or resources.

However, assurance procedures alone,

even when performed with due

professional care, do not guarantee that

all significant risks will be identified.

Standard 2010 — Planning

The chief audit executive must establish

a risk-based plan to determine the

priorities of the internal audit activity,

consistent with the organization’s goals.

7

Additionally, Standard 2010 requires chief audit executives to establish a risk-based plan to determine the

priorities of the internal audit activity, consistent with the organization’s goals. The related interpretation states:

To develop the risk-based plan, the chief audit executive consults with senior management

and the board and obtains an understanding of the organization’s strategies, key business

objectives, associated risks, and risk management processes. The chief audit executive

must review and adjust the plan, as necessary, in response to changes in the organization’s

business, risks, operations, programs, systems, and controls.

In the global economy, executive management, boards, and CAEs who ignore the downside of ESG risks do

so at their peril and miss the value of maintaining a resilient supply chain by considering these risks.

An additional ESG risk not far from the headlines is the effect of climate change and rising sea levels. A

recent publicly available report from Verisk Maplecroft indicates possible significant risk to Chinese

manufacturing hubs.4

Both the pandemic flu risk and the rising sea level risk suggest an inherent weakness in the business decision

to concentrate supply chains in areas of potentially “extreme” or “significant” risk, without redundancy in other

areas of the world with lower risk.

Understanding of ESG risks related to pandemics and climate change are evolving but are by no means new.

However, are organizations adequately considering these risks in designing business models and global

supply chains?

In the reality of the global economy, ESG risks can no longer be relegated to “non-material” considerations.

C-suites, boards and internal audit must work together to understand, consider and leverage ESG risks to

weather the storms that are inevitably, and predictably, coming.

4. China’s Manufacturing Heartland Most at Risk from Rising Seas: Environmental Risk Outlook 2020 (Verisk Maplecroft,

Feb. 27, 2020), https://www.maplecroft.com/insights/analysis/chinas-manufacturing-heartland-most-at-risk-from-rising-

seas/

ABOUT THE ENVIRONMENTAL, HEALTH & SAFETY AUDIT CENTER The Environmental, Health & Safety Audit Center (EHSAC) is a specialty offering of The IIA for environmental, health and safety (EHS)

auditing. EHSAC was established to provide auditors with targeted high-quality professional development; networking opportunities for

knowledge sharing among EHS stakeholders; and ongoing, timely, and relevant reporting on trends, benchmarking, and thought leadership

in the audit profession. This report is reserved for your exclusive use as a member of the Environmental, Health & Safety Audit Center. For

more information, visit www.theiia.org/EHSAC.

ABOUT THE IIA

The Institute of Internal Auditors (IIA) is the internal audit profession’s most widely recognized advocate, educator, and provider of standards,

guidance, and certifications. Established in 1941, The IIA today serves more than 200,000 members from more than 170 countries and

territories. The association’s global headquarters is in Lake Mary, Fla. For more information, visit www.theiia.org.

DISCLAIMER

The EHSAC and The IIA publish this document for informational and educational purposes. This material is not intended to provide definitive

answers to specific individual circumstances and as such is only intended to be used as a guide. The EHSAC and The IIA recommend

seeking independent expert advice relating directly to any specific situation. The EHSAC and The IIA accept no responsibility for anyone

placing sole reliance on this material.

COPYRIGHT

Copyright © 2020 The Institute of Internal Auditors, Inc. All rights reserved. For permission to reproduce, please contact copyright@theiia.org.

March 2020

Global Headquarters The Institute of Internal Auditors 1035 Greenwood Blvd., Suite 149 Lake Mary, FL 32746 USA Phone: +1-407-937-1111 Fax: +1-407-937-1101 www.theiia.org/EHSAC